fix: grant unrestricted --allow-write so PERSIST can be any directory (#65)

.github/workflows/ci.yml

@@ -35,7 +35,7 @@ jobs:
           touch persist.dat
           deno compile \
             --allow-read \
-            --allow-write=./persist.dat \
+            --allow-write \
             --allow-net=0.0.0.0:3000 \
             --allow-env=HOST,PORT,PERSIST,QUEUE_API_TOKEN,QUEUE_DEPTH_LIMIT,QUEUE_COUNT_LIMIT,RATE_LIMIT_REQUESTS \
             main.ts

Dockerfile

@@ -7,7 +7,7 @@ COPY . /queue
 
 WORKDIR /queue
 
-RUN deno compile --allow-read --allow-write=./persist.dat --allow-net=${DENO_HOST}:${DENO_PORT} --allow-env=HOST,PORT,PERSIST,QUEUE_API_TOKEN,QUEUE_DEPTH_LIMIT,QUEUE_COUNT_LIMIT,RATE_LIMIT_REQUESTS --allow-sys main.ts && cp ./queue /usr/bin/
+RUN deno compile --allow-read --allow-write --allow-net=${DENO_HOST}:${DENO_PORT} --allow-env=HOST,PORT,PERSIST,QUEUE_API_TOKEN,QUEUE_DEPTH_LIMIT,QUEUE_COUNT_LIMIT,RATE_LIMIT_REQUESTS --allow-sys main.ts && cp ./queue /usr/bin/
 
 RUN chown -R deno:deno /queue /usr/bin/queue
 

tests/compiled_binary_test.ts

@@ -100,3 +100,36 @@ Deno.test({
     sanitizeResources: false,
     sanitizeOps: false,
 });
+
+Deno.test({
+    name: "compiled binary: starts and persists with an arbitrary --persist dir (#65)",
+    fn: async () => {
+        const tempDir = await Deno.makeTempDir({ prefix: "queue-compile-test-" });
+        const outPath = `${tempDir}/queue`;
+        const persistDir = `${tempDir}/persist`;
+        try {
+            await compile(
+                [
+                    "--allow-read",
+                    "--allow-write",
+                    "--allow-net",
+                    "--allow-env",
+                    "--allow-sys",
+                ],
+                outPath,
+            );
+            const { started, output } = await probeStartup(outPath, ["--persist"], {
+                QUEUE_API_TOKEN: "compile-test-token",
+                HOST: "127.0.0.1",
+                PORT: "0",
+                PERSIST: persistDir,
+            });
+            assertEquals(started, true, `binary did not report listening. Output:\n${output}`);
+        } finally {
+            await Deno.remove(tempDir, { recursive: true }).catch(() => {});
+        }
+    },
+    // Compiling a 100MB+ binary is slow; this is an integration test, not a unit test.
+    sanitizeResources: false,
+    sanitizeOps: false,
+});